ssize Syntax Rules
The **ssize** field is used to detect the session size. The session size is accumulated unidirectionally based on the TCP or UDP payload. Example: ``` flow: to_server; content:"xget"; ssize:< 1000; ``` When the TCP/UDP Payload content matches the **xget** feature string and the length of the payload currently received is smaller than 1000 bytes, the rule is matched. Supported operators | Keyword | Description | | ---------------- | --------------- | | ssize:1000; | Equal to | | ssize:>1000;; | Greater than | | ssize:<1000; | Smaller than | | ssize:!1000; | Not equal to | | ssize:200<>1000; | Between 200 and 1000 |